X-Git-Url: http://git.grml.org/?a=blobdiff_plain;f=grml-terminalserver;h=3303df4336683da8bce6f79e76df52f85099a78f;hb=d8aa8496d6758d340eeff677a3f1edcda9b98a78;hp=050df3100418729a1807faaa55473ccdece1f84b;hpb=3532250cadbf77f0c4172c723825c0f8b129f424;p=grml-terminalserver.git

diff --git a/grml-terminalserver b/grml-terminalserver
index 050df31..3303df4 100755
--- a/grml-terminalserver
+++ b/grml-terminalserver
@@ -54,7 +54,7 @@ SERVICES:
   dhcp        Dhcp daemon
   nfs         All necessary nfs daemons
   <>          ALL services
-  
+
 OPTIONS:
    -v         verbose (show what is going on, v++)
    -h         this help text
@@ -112,14 +112,16 @@ function stopDhcp
   rm -f /var/lib/dhcp3/dhcpd.leases* 2>/dev/null    #FIXME
   touch /var/lib/dhcp3/dhcpd.leases
 }
+
 function startDhcp
 {
   local conf_file_="$DHCPD_CONFIG_FILE_"
-  
+
   test -f $DHCPD_BIN_ || die "could not find dhcpd \"$DHCPD_BIN_\""
   start-stop-daemon --start --quiet --pidfile "$DHCPD_PID_" \
     --exec "$DHCPD_BIN_" -- -cf "$conf_file_" -q "$INTERFACE_" || warn "problems starting dhcpd"
 }
+
 function runDhcp
 {
   isExistent "$DHCPD_CONFIG_FILE_" || \
@@ -129,6 +131,58 @@ function runDhcp
   sleep 1
   startDhcp
 }
+
+# make sure tcp/113 is rejected
+function runIptables
+{
+ if [ -x /sbin/iptables ] ; then
+    # something keeps answering all tftp requests with auth requests (SYN
+    # packets to the client tcp/113). Since the PXE client doesn't answer with
+    # RST, the auth query has to wait until it times out. Forbidding the
+    # terminalserver to send out packets to tcp/113 via iptables _greatly_
+    # speeds up the process. But of course the real fix would be to have grml
+    # stop sending out auth queries to tftp clients. according to netstat, it
+    # is in.tftpd itself sending out the auth queries.
+    # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix.
+    if iptables -L | grep -q '^REJECT.*tcp dpt:auth reject-with tcp-reset' ; then
+       echo "Rule for tcp/113 already present, nothing to be done."
+    else
+       echo "Rejecting tcp/113 via iptables to speed up booting via PXE, running:"
+       echo -n '* iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset ... '
+       iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset && echo done || echo failed
+    fi
+    # deactivate Multicast-DNS
+    if iptables -L | grep -q '^REJECT.*dpt:mdns reject-with icmp-port-unreachable' ; then
+       echo "Rule for udp/5353 already present, nothing to be done."
+    else
+       echo "Rejecting udp/5353 via iptables for deactivating Multicast-DNS, running:"
+       echo -n '* iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT ... '
+       iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT && echo done || echo failed
+    fi
+    if [ "$NAT_INTERFACE_" != "none" ]; then
+       local nat_source_ip_=`netGetIp "$NAT_INTERFACE_" warn`
+
+       if iptables -t nat -vnL POSTROUTING | grep -q "SNAT.*${NAT_INTERFACE_}.*to:${nat_source_ip_}" ; then
+          echo "Rule for SNAT already present, nothing to be done."
+       else
+          echo "Setting up SNAT for terminalserver clients on ${NAT_INTERFACE_}:"
+          echo    "* iptables -t nat -F POSTROUTING"
+          echo -n "* iptables -t nat -A POSTROUTING -o $NAT_INTERFACE_ -j SNAT --to-source $nat_source_ip_ ... "
+          { iptables -t nat -F POSTROUTING && \
+            iptables -t nat -A POSTROUTING -o "$NAT_INTERFACE_" -j SNAT --to-source "$nat_source_ip_" ; } && \
+            echo done || echo failed
+       fi
+       if [ `cat /proc/sys/net/ipv4/ip_forward` -eq 1 ]; then
+          echo "IP-Forwarding already enabled, nothing to be done."
+       else
+          echo -n "Enabling IP-Forwarding: "
+          echo 1 > /proc/sys/net/ipv4/ip_forward && echo done || echo failed
+       fi
+    fi
+ else
+    warn "iptables executable not avilable"
+ fi
+}
 # }}}
 
 # TFTP SERVICE {{{
@@ -139,7 +193,7 @@ function removeTftpConf
 function createTftpConf
 {
   removeTftpConf
-  
+
   execute "mkdir $TFTPD_DATA_DIR_/pxelinux.cfg" die
   execute "install -m 644 /usr/lib/syslinux/pxelinux.0 $TFTPD_DATA_DIR_" die
   execute "install -m 644 $PATH_/minirt26.gz $TFTPD_DATA_DIR_" die
@@ -153,12 +207,12 @@ function createTftpConf
 
 function stopTftp
 {
-  start-stop-daemon --stop --quiet --name "${TFTPD_BIN_##*/}"
+  start-stop-daemon --stop --quiet -p "$TFTPD_PID_"
 }
 function startTftp
 {
   test -f $TFTPD_BIN_ || die "could not find \"$TFTPD_BIN_\""
-  start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- -l -a "$IP_" -s "$TFTPD_DATA_DIR_" || \
+  start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- --daemon --no-multicast --pidfile "$TFTPD_PID_" --bind-address "$IP_" "$TFTPD_DATA_DIR_" || \
     warn "problems starting tftpd server"
 }
 function runTftp
@@ -217,16 +271,17 @@ function createConfig
 function actionStart
 {
   createConfig
-  
-  echo -n "Starting tftpd..."
-  runTftp
-  echo "done"
-  echo -n "Starting dhcpd..."
-  runDhcp
-  echo "done"
-  echo -n "Starting nfs..."
-  startNfs
-  echo "done"
+
+  echo -n "Starting tftpd: "
+  runTftp && echo done || echo failed
+
+  echo -n "Starting dhcpd: "
+  runDhcp && echo done || echo failed
+
+  #runIptables
+
+  echo "Finally starting nfs services..."
+  startNfs && echo "Sucessfully finished startup of grml-terminalserver." || echo 'Startup of grml-terminalserver-config failed!'
 }
 
 function actionStop
@@ -326,7 +381,7 @@ PXE_BOOT_MSG_=\"$PXE_BOOT_MSG_\"
 PXE_BOOT_LOGO_=\"$PXE_BOOT_LOGO_\""
   die "False configuration, please update $CONFIG_"
 fi
-  
+
 case "$1" in
   clean) actionClean; exit 0 ;;
 esac
@@ -340,7 +395,7 @@ while true; do
       "grml-terminalserver-config returned an error, do you want to quit now?" 5 75 && exit 1
   else
     break
-  fi  
+  fi
 done
 source $CONF_FILE_